Bug 217446

Summary:	REGRESSION: ASSERTION FAILED: verticalGap >= 0 in WebCore::Layout::InlineFormattingState::setClearGapAfterLastLine
Product:	WebKit	Reporter:	Ryan Haddad <ryanhaddad>
Component:	Layout and Rendering	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	bfulgham, simon.fraser, webkit-bug-importer, zalan
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Description Ryan Haddad 2020-10-07 14:08:24 PDT

ASSERTION FAILED: verticalGap >= 0
./layout/inlineformatting/InlineFormattingState.h(84) : void WebCore::Layout::InlineFormattingState::setClearGapAfterLastLine(WebCore::InlineLayoutUnit)
1   0x13d3de099 WTFCrash
2   0x11d21c87b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x120c41c70 WebCore::Layout::InlineFormattingState::setClearGapAfterLastLine(float)
4   0x120c4128b WebCore::Layout::InlineFormattingContext::lineLayout(WTF::Vector<WebCore::Layout::InlineItem, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::Layout::LineBuilder::InlineItemRange, WebCore::Layout::FormattingContext::ConstraintsForInFlowContent const&)
5   0x120c40084 WebCore::Layout::InlineFormattingContext::layoutInFlowContent(WebCore::Layout::InvalidationState&, WebCore::Layout::FormattingContext::ConstraintsForInFlowContent const&)
6   0x120c69173 WebCore::LayoutIntegration::LineLayout::layout()
7   0x121856d19 WebCore::RenderBlockFlow::layoutLFCLines(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
8   0x121854498 WebCore::RenderBlockFlow::layoutInlineChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
9   0x121853549 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
10  0x1218363c9 WebCore::RenderBlock::layout()
11  0x1218561c2 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
12  0x121854784 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
13  0x121853566 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
14  0x1218363c9 WebCore::RenderBlock::layout()
15  0x1218561c2 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
16  0x121854784 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
17  0x121853566 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
18  0x1218363c9 WebCore::RenderBlock::layout()
19  0x1218561c2 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
20  0x121854784 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
21  0x121853566 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
22  0x1218363c9 WebCore::RenderBlock::layout()
23  0x1218561c2 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
24  0x121854784 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
25  0x121853566 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
26  0x1218363c9 WebCore::RenderBlock::layout()
27  0x1218561c2 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
28  0x121854784 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
29  0x121853566 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
30  0x1218363c9 WebCore::RenderBlock::layout()
31  0x121b096a3 WebCore::RenderView::layout()
LEAK: 2 WebPageProxy

Comment 1 Ryan Haddad 2020-10-07 14:09:20 PDT

Saw the assertion above on Catalina Debug WK2 with the following tests:

accessibility/content-changed-notification-causes-crash.html
fast/block/float/float-append-child-crash.html
fast/css/simple-layout-overflow.html
fast/shapes/shape-outside-floats/shape-outside-negative-line-height-crash.html
imported/blink/fast/borders/border-box-overflow-crash.html

https://build.webkit.org/results/Apple-Catalina-Debug-WK2-Tests/r268135%20(7082)/results.html

Comment 2 zalan 2020-10-07 14:09:25 PDT

fixed in https://trac.webkit.org/changeset/268150/webkit

Comment 3 Radar WebKit Bug Importer 2020-10-07 14:10:16 PDT

<rdar://problem/70064317>